zzh217/cve-2018-9995_batch_scanning_expCVE-2018-9995_Batch_scanning_exp
Batch scanning script for DVR based on CVE-2018-9995 vulnerability
python3, ubuntu
user@ubuntu:~$ sudo pip3 install grequests
user@ubuntu:~$ sudo pip3 install tableprint
Store the devices to be scanned in the first column of a CSV file in the format of ip:port
The equipment to be scanned is stored in "ip:port" form in the first column of CSV file.
csv_file = csv.reader(open('66b2f74b75457f73347f6a840bebc339.csv','r'))
Change the above device list file directory to the current directory
Change the list of device list files to the current directory.
user@ubuntu:~$ sudo python3 CVE-2018-9995_Batch_scanning_exp.py
Run the program
run
-----------------------------------501-------------------------------------------------------------
-----------------------------------501-------------------------------------------------------------
-----------------------------------501-------------------------------------------------------------
-----------------------------------NO.1-------------------------------------------------------------
[+] Users List: 1
[+] Users List: 1
[+] Users List: 1
[+] Users List: 1
[+] Users List: 1
[+] Users List: 1
[+] Users List: 2
[+] Users List: 1
Output occurs every 501 IPs. 'NO' indicates the round number, and '[+] Users List:' indicates the number of users contained in the device that successfully exploited the vulnerability.
Every 501 IP output is once, "NO" indicates the number of rounds, and "[+] Users List:" indicates the number of users contained in the device that successfully exploited the vulnerability.
Output as a CSV file named pass.csv
output pass.csv
--------+-----+----+-------+----.......
ip:port |uid1 |pwd1 |role1 |uid2.......
--------+-----+----+-------+----.......
| | | | .......
| | | | .......
1. Solved the problem that some devices cannot return information due to 401 error (Solved the problem that part of the equipment 401 error can not return information.)
2. Solved the problem of incorrect JSON format returned by some devices (The problem of incorrect JSON format for some devices is solved.)
3. Adopted asynchronous HTTP requests, greatly improving scanning efficiency (Using asynchronous HTTP request greatly improves scanning efficiency.)
1. According to the query results from major web device search engines, there are about 50,000 devices designed for this vulnerability. Currently, any device that responds to a connection can exploit this vulnerability to obtain plaintext login credentials.
1.There are about 50000 devices designed for this vulnerability from the results of the search engine query for web equipment. At present, any device with connection response can take advantage of the vulnerability to obtain information on the login account.
2. Within the wall (China), only about 6,000 devices responded to the scan.
2.There are only more than 6000 devices in response to the scan in china
3. The harm of vulnerability exploitation is not as serious as expected. It only provides access to video streams. Further access to control of the device system remains to be studied.
3.The harm of vulnerability is not as serious as expected. It is only the right of access to the screen. Further access to control of the device system remains to be studied.
4. There are really many weak passwords. 80% of the scan results used weak passwords.
4.There are many weak passwords, and 80% of the scan results use weak passwords.
Getting the list of vulnerable devices relies on your own skills. With a little thought, it's still easy to obtain. Have fun! XD have fun！ XD